Differential Fault Analysis of Ascon under 5-Bit S-Box Fault Injection

Ascon, the winner of the NIST Lightweight Cryptography competition, was standardized in 2025 as a lightweight cryptographic primitive for securing the Internet of Things and other resource-constrained devices. Although Ascon is well suited to embedded deployment, its implementation security against fault attacks remains insufficiently understood. In this paper, we propose differential fault analysis (DFA) methods based on 5-bit fault injections and the differential properties of the Ascon S-box. We introduce the concept of fault trails to characterize the evolution of candidate S-box input sets under 5-bit faults. Based on this framework, two fault models are developed to recover the intermediate state in the Finalization stage and ultimately the 128-bit key. Furthermore, we derive the expected numbers of fault injections required to recover a single S-box input under fault models A and B, and simulation results are shown to be in close agreement with the theoretical values. In addition, we consider several fault-injection settings that better reflect practical attack scenarios, including non-uniform fault distributions, different fault invalidation probabilities, and different fault widths. Under fault model A, 391 5-bit faults or 13.3 register-width faults are required on average to recover the 128-bit key. Under fault model B, the corresponding numbers are 289 and 13.1, respectively, outperforming the existing DFA results on Ascon.